Mobile electronic communication devices have evolved beyond simple telephone functionality and are now highly complex multifunctional devices with capabilities rivaling those of desktop or laptop computers. In addition to voice communications, many mobile communication devices are capable of text messaging, e-mail communications, internet access, and the ability to run full-featured application software. Mobile communication devices can use these capabilities to perform online transactions such as banking, stock trading, payments, and other financial activities. Furthermore, mobile communication devices used by an individual, a business, or a government agency often store confidential or private information in forms such as electronic documents, text messages, access codes, passwords, account numbers, e-mail addresses, personal communications, phone numbers, and financial information.
In addition to the functionality described above, mobile electronic communication devices are frequently being used to perform mobile payments, thereby eliminating the need, in some cases, for customers to carry coin/paper currency, checks or credit/debit cards. In a particular implementation, a merchant or a service provider is equipped with a point of sale (“POS”) module, e.g., an NFC reader, that is coupled to a payment processing system on a server or in a cloud computing environment. When a mobile communication device is configured for mobile payments, a user of the device can purchase items from the merchant by simply using the device to exchange a user's payment credentials from the device to the POS module. The credentials can be transmitted to the POS module by tapping the configured mobile communication device on a sensor of the POS module, or by waving the device near the POS module's sensor. The payment amount can be deducted from a pre-paid account or charged to a mobile or bank account directly.
As mobile payments using phone-based or electronic wallet-based payments mediated by the use of mobile devices become more widespread, it is more likely that there will be attempts to steal user payment credentials and to use them fraudulently. This could be done by malware on a user's communication device or personal computer, or by network eavesdropping on a user's network connections, for example. Accordingly, a merchant, a payment processor, and/or the user herself need to be sure that when mobile payment credentials are presented at a POS module, the person presenting them is actually the user associated with the payment credentials or is someone who has stolen the payment credentials to make unauthorized purchases.